IPSec, VPN with multiple sites

First of all, I hope I am posting this to the correct forum. If not, please let me know where I need to go.

My Scenerio:
I have 12 different sites. Some of these sites have private ip addresses behind NAT which doesn’t allow us to connect to them with Timbuktu, a desktop support application. I have read the articles about IPSec, NAT on OS X Server, and a couple of the ssh artilces. I have a good idea about how I want to connect these sites but I am not sure if all of my pieces will play nicely with the others.

My Locations:
Site 1 (Central office where all of the connections will come back to):
We are using a Cisco Router with 3com OfficeConnect firewall. We have an xserve which we are going to run NAT on. This will be the device we will use in our office to VPN to the sites. My question here is “Can the IPSec tunnel be set up to pass through a firewall as long as the proper ports are open, or will have to try to set up the firewall to run the tunnel?”

Site 2:
Here we are running a Cisco Router with a Symantec Gateway Appliance. This will be the device we will use to connect our tunnel to this site. My question is “Does anyone know if you can connect OS X to a SGA much like the artilce explains connecting to a SonicWall?”

Site 3:
Here we are running a Cisco Router with a Cisco Pix firewall. The Pix will be the divice I connect to at this location. Same question here, “Can I connect the OS X server to the pix and are there any know issues?”

Site 4:
Here we are running a Cisco Router, OfficeConnect Firewall and a Windows 2000 server running NAT/DHCP. “Can I connect to the 2000 server from my OS X Server using IPSec tunneling described in the ‘Flying racoon’ articles?”

The rest of the sites are like one of the four above. I am quite new to this but I have spent the majority of my last couple of months trying to figure this stuff out. If anyone knows of any known issues in any of these devices, your input would be greatly appreciated.

Thanks,
Jeremy
jeremyrooks@mac.com